Home / mailings [USN-1373-2] OpenJDK 6 (ARM) vulnerabilities
Posted on 01 March 2012
Ubuntu Security==========================
==========================
========================
Ubuntu Security Notice USN-1373-2
March 01, 2012
openjdk-6b18 vulnerabilities
==========================
==========================
========================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
Summary:
Multiple vulnerabilities in OpenJDK 6 for the ARM architecture have
been fixed.
Software Description:
- openjdk-6b18: Open Source Java implementation
Details:
USN 1373-1 fixed vulnerabilities in OpenJDK 6 in Ubuntu 10.04 LTS,
Ubuntu 10.10 and Ubuntu 11.04 for all architectures except for ARM
(armel). This provides the corresponding OpenJDK 6 update for use
with the ARM (armel) architecture in Ubuntu 10.04 LTS, Ubuntu 10.10
and Ubuntu 11.04.
Original advisory details:
It was discovered that the Java HttpServer class did not limit the
number of headers read from a HTTP request. A remote attacker could
cause a denial of service by sending special requests that trigger
hash collisions predictably. (CVE-2011-5035)
=20
ATTENTION: this update changes previous Java HttpServer class behavior
by limiting the number of request headers to 200. This may be increased
by adjusting the sun.net.httpserver.maxReqHeaders property.
=20
It was discovered that the Java Sound component did not properly
check buffer boundaries. A remote attacker could use this to cause
a denial of service or view confidential data. (CVE-2011-3563)
=20
It was discovered that the Java2D implementation does not properly
check graphics rendering objects before passing them to the native
renderer. A remote attacker could use this to cause a denial of
service or to bypass Java sandbox restrictions. (CVE-2012-0497)
=20
It was discovered that an off-by-one error exists in the Java ZIP
file processing code. An attacker could us this to cause a denial of
service through a maliciously crafted ZIP file. (CVE-2012-0501)
=20
It was discovered that the Java AWT KeyboardFocusManager did not
properly enforce keyboard focus security policy. A remote attacker
could use this with an untrusted application or applet to grab keyboard
focus and possibly expose confidential data. (CVE-2012-0502)
=20
It was discovered that the Java TimeZone class did not properly enforce
security policy around setting the default time zone. A remote attacker
could use this with an untrusted application or applet to set a new
default time zone and bypass Java sandbox restrictions. (CVE-2012-0503)
=20
It was discovered the Java ObjectStreamClass did not throw
an accurately identifiable exception when a deserialization
failure occurred. A remote attacker could use this with
an untrusted application or applet to bypass Java sandbox
restrictions. (CVE-2012-0505)
=20
It was discovered that the Java CORBA implementation did not properly
protect repository identifiers on certain CORBA objects. A remote
attacker could use this to corrupt object data. (CVE-2012-0506)
=20
It was discovered that the Java AtomicReferenceArray class
implementation did not properly check if an array was of
the expected Object[] type. A remote attacker could use this
with a malicious application or applet to bypass Java sandbox
restrictions. (CVE-2012-0507)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.04:
icedtea-6-jre-cacao 6b18-1.8.13-0ubuntu1~11.04.1
icedtea-6-jre-jamvm 6b18-1.8.13-0ubuntu1~11.04.1
openjdk-6-jre 6b18-1.8.13-0ubuntu1~11.04.1
openjdk-6-jre-headless 6b18-1.8.13-0ubuntu1~11.04.1
openjdk-6-jre-zero 6b18-1.8.13-0ubuntu1~11.04.1
Ubuntu 10.10:
icedtea-6-jre-cacao 6b18-1.8.13-0ubuntu1~10.10.1
openjdk-6-jre 6b18-1.8.13-0ubuntu1~10.10.1
openjdk-6-jre-headless 6b18-1.8.13-0ubuntu1~10.10.1
openjdk-6-jre-zero 6b18-1.8.13-0ubuntu1~10.10.1
Ubuntu 10.04 LTS:
icedtea-6-jre-cacao 6b18-1.8.13-0ubuntu1~10.04.1
openjdk-6-jre 6b18-1.8.13-0ubuntu1~10.04.1
openjdk-6-jre-headless 6b18-1.8.13-0ubuntu1~10.04.1
openjdk-6-jre-zero 6b18-1.8.13-0ubuntu1~10.04.1
After a standard system update you need to restart any Java applications
or applets to make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1373-2
http://www.ubuntu.com/usn/usn-1373-1
CVE-2011-3563, CVE-2011-5035, CVE-2012-0497, CVE-2012-0501,
CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506,
CVE-2012-0507
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-6b18/6b18-1.8.13-0ubuntu1~11=
=2E04.1
https://launchpad.net/ubuntu/+source/openjdk-6b18/6b18-1.8.13-0ubuntu1~10=
=2E10.1
https://launchpad.net/ubuntu/+source/openjdk-6b18/6b18-1.8.13-0ubuntu1~10=
=2E04.1
